A Security Firm Got Breached By Its Own Ex-Employee

CrowdSec, a French cybersecurity firm that makes threat-detection tools, discovered in September that 170 of its private GitHub repositories had been stolen back in May, according to Dark Reading. The whole operation took nine minutes.

The attackers used the Shai-Hulud worm — malware spread through a supply chain attack (where malicious code is hidden inside a trusted software package that developers install routinely) on the TanStack npm package — to compromise a former employee's computer. That machine still held a working GitHub OAuth token (a type of access credential that lets applications read account data without a password) tied to the ex-developer's account. The account still had full read access to CrowdSec's private repositories because the company had not revoked it when he left.

Between 5:52 and 6:01 am UTC on 22 May, the attacker downloaded the contents of 170 repositories. CrowdSec only discovered the breach on 16 September, when someone posted an archive of the stolen source code on an underground forum.

CrowdSec says no infrastructure, databases, or build pipelines were tampered with. The stolen material was source code only.

The lesson is almost painfully simple: when someone leaves your organisation, revoke their access the same day. Not the same week. That day.

What you should do: If you run any project on GitHub, audit your organisation's member list today. Remove anyone who no longer needs access.

Researchers at Vigilance Security have identified a large-scale campaign, dubbed "Dark Sourcery," that is poisoning the results delivered by ChatGPT, Google Gemini, and Google AI Overview, according to Dark Reading.

Attackers are flooding the web with fake support pages, fraudulent phone numbers, and phishing login portals — then using SEO (search engine optimisation, the process of making web pages rank higher in results) to ensure AI chatbots scrape and repeat this content as fact. When you ask an AI for a customer support number for your bank, it may hand you a criminal's call centre instead. At least 374 companies have been swept up, including Delta, Chase, and Bank of America.

What makes this especially dangerous: a study found 91% of AI chatbot users do not verify the answers they receive. Treat AI-provided contact details the same way you would a random Google result. Look up phone numbers and support pages directly on the official website instead.

What F5 BIG-IP APM is: A network appliance used by enterprises and government agencies to manage secure remote access and enforce access policies across web applications.

What it is: A critical flaw in BIG-IP APM allows an attacker with no credentials whatsoever to execute arbitrary code (RCE — remote code execution, meaning the attacker can run any command they choose on the target system) remotely. F5 and CISA confirmed active exploitation, as reported by Security Week.

Who's at risk: Organisations running BIG-IP APM versions 17.1.0 to 17.1.3, 17.5.0 to 17.5.1, or 21.1.0, specifically where the system is configured as an OAuth Authorization Server (a service that issues access tokens to authenticate users and applications). Deployments using APM only as an OAuth Client or Resource Server are not affected.

CVSS: 9.8 — Critical. Patch today.

Root cause: The flaw exists in how BIG-IP APM processes traffic to a virtual server when both an APM access policy and an OAuth profile are active together. Malformed or specifically crafted requests to that configuration bypass authentication entirely, giving the attacker a direct path to code execution. The vulnerability lives on the data plane — the part of the appliance that handles live network traffic — meaning it can be triggered from outside the organisation without any internal access.

Attack vector: An unauthenticated attacker sends a specially crafted request to the virtual server running BIG-IP APM in OAuth Authorization Server mode. The appliance processes the malicious traffic without verifying who sent it, executing the attacker's payload and granting them full control of the device. No phishing, no credentials, no foothold required — just a network connection to the exposed service.

Detection strategies:

1. Review the three indicators of compromise (IoCs) published in F5's advisory and cross-reference them against your BIG-IP APM logs immediately.
2. Look for unexpected outbound connections or unusual processes spawned on the appliance following inbound OAuth-related traffic.
3. Monitor for authentication events on the virtual server that lack corresponding valid session records — a sign that someone probed the OAuth endpoint without a legitimate token.

Recommended actions:

1. Apply F5's hotfix immediately — affected versions are 17.1.0–17.1.3, 17.5.0–17.5.1, and 21.1.0.
2. If patching is not immediately possible, remove the OAuth Authorization Server configuration from exposed virtual servers as a temporary mitigation.
3. Check CISA's Known Exploited Vulnerabilities catalogue and follow BOD 26-04 if your organisation is a federal agency — the patch deadline is three days from the advisory.

CISA has published new guidance on cyber deception — the practice of setting digital traps to catch attackers before they cause serious damage, as covered by Dark Reading.

The idea is simpler than it sounds. Create a file on your network called something like passwords.xlsx and configure an alert to fire the moment anyone opens it. A legitimate employee will probably never touch it. An attacker who has already found their way in almost certainly will — because it looks like exactly what they came for.

CISA's guide also covers "honey users" — decoy accounts in your user directory that no real person ever logs into. Any login attempt on one of them is an immediate red flag.

These techniques require no expensive software. A single decoy file or account, properly monitored, gives you an early warning system that many commercial tools cannot match. Read CISA's full guidance here and consider starting with one honey file this week.

Canada's Privacy Commissioner has opened a formal investigation into IDScan.net, a company that provides ID verification technology to retailers and hospitality businesses, according to The Record. Hackers accessed the company's cloud platform and stole personal data and driver's licence scans belonging to 153 million people. The probe will examine whether IDScan's security practices were adequate and whether affected individuals were notified properly under Canadian federal privacy law. If you have had your ID scanned at a bar, hotel, or retail store, your details may be among those exposed.